NFS Storage

Configure NFS servers and clients for network file sharing across Linux systems. Covers NFSv4 server setup, export options, client mounting, autofs for on-demand mounts, Kerberos security, performance tuning, and Kubernetes integration.

When to Use

• Sharing directories between multiple Linux servers (web farms, build clusters)
• Providing shared storage for containerized workloads (Kubernetes ReadWriteMany)
• Centralizing home directories or application data across a fleet
• Setting up a development environment with shared project files
• Migrating from local storage to network-attached storage

Prerequisites

• NFS server: nfs-kernel-server (Debian/Ubuntu) or nfs-utils (RHEL/CentOS)
• NFS client: nfs-common (Debian/Ubuntu) or nfs-utils (RHEL/CentOS)
• Network connectivity between server and clients (TCP/UDP 2049 for NFSv4)
• Firewall rules allowing NFS traffic
• For NFSv4 Kerberos: krb5-user and a functioning KDC

NFS Server Setup

Installation

# Debian / Ubuntu
apt update && apt install -y nfs-kernel-server

# RHEL / CentOS
dnf install -y nfs-utils

# Enable and start the NFS server
systemctl enable --now nfs-server

# Verify NFS is running
systemctl status nfs-server
rpcinfo -p | grep nfs

Export Configuration (/etc/exports)

# /etc/exports
# Syntax: <directory> <client-spec>(options)

# Share /data to a specific subnet with read-write access
/data 10.0.0.0/24(rw,sync,no_subtree_check,no_root_squash)

# Share /shared read-only to everyone
/shared *(ro,sync,no_subtree_check)

# Share /home to specific hosts
/home server01.example.com(rw,sync,no_subtree_check)
/home server02.example.com(rw,sync,no_subtree_check)

# Share /var/nfs/projects with root squash (default, map root to nobody)
/var/nfs/projects 10.0.0.0/24(rw,sync,no_subtree_check,root_squash)

# NFSv4 pseudo-root export (recommended for NFSv4)
/srv/nfs 10.0.0.0/24(rw,sync,fsid=0,crossmnt,no_subtree_check)
/srv/nfs/data 10.0.0.0/24(rw,sync,no_subtree_check,no_root_squash)
/srv/nfs/shared 10.0.0.0/24(ro,sync,no_subtree_check)

Export Options Explained

Applying Export Changes

# Apply changes to exports (no server restart needed)
exportfs -ra

# Show current exports
exportfs -v

# Export a new directory on the fly (temporary, not persistent)
exportfs -o rw,sync,no_subtree_check 10.0.0.0/24:/tmp/share

# Unexport a directory
exportfs -u 10.0.0.0/24:/tmp/share

Server Firewall Configuration

# UFW (Ubuntu)
ufw allow from 10.0.0.0/24 to any port nfs
ufw allow from 10.0.0.0/24 to any port 111   # rpcbind (NFSv3)

# firewalld (RHEL/CentOS)
firewall-cmd --permanent --add-service=nfs
firewall-cmd --permanent --add-service=rpc-bind
firewall-cmd --permanent --add-service=mountd
firewall-cmd --reload

# NFSv4 only needs TCP 2049 (no rpcbind or mountd)
firewall-cmd --permanent --add-port=2049/tcp
firewall-cmd --reload

NFS Client Configuration

Manual Mounting

# Install NFS client
apt install -y nfs-common        # Debian/Ubuntu
dnf install -y nfs-utils         # RHEL/CentOS

# Discover exports from the server
showmount -e nfs-server.example.com

# Mount an NFS share manually
mkdir -p /mnt/data
mount -t nfs nfs-server.example.com:/data /mnt/data

# Mount with specific NFS version and options
mount -t nfs -o vers=4.2,tcp,hard,intr nfs-server.example.com:/data /mnt/data

# Verify the mount
mount | grep nfs
df -hT /mnt/data

# Unmount
umount /mnt/data

Persistent Mounts via /etc/fstab

# /etc/fstab entries for NFS

# Basic NFSv4 mount
nfs-server.example.com:/data  /mnt/data  nfs4  defaults,_netdev  0  0

# Mount with performance and reliability options

…